Manages forms-authentication services for Web applications. This class cannot be inherited.
Assembly: System.Web (in System.Web.dll)
Gets the value of the domain of the forms-authentication cookie.
Gets a value that indicates whether the application is configured for cookieless forms authentication.
Gets a value that indicates whether the application is configured to support cookieless forms authentication.
Gets the URL that theclass will redirect to if no redirect URL is specified.
Gets a value indicating whether authenticated users can be redirected to URLs in other Web applications.
Gets the name of the cookie used to store the forms-authentication ticket.
Gets the path for the forms-authentication cookie.
Gets a value that indicates whether forms authentication is enabled.
Gets the URL for the login page that theclass will redirect to.
Gets a value indicating whether the forms-authentication cookie requires SSL in order to be returned to the server.
Gets a value indicating whether sliding expiration is enabled.
Gets a value that indicates whether to use Coordinated Universal Time (UTC) or local time for the ticket expiration date.
Gets the amount of time before an authentication ticket expires.
Obsolete.Validates a user name and password against credentials stored in the configuration file for an application.
Creates a FormsAuthenticationTicket object based on the encrypted forms-authentication ticket passed to the method.
Creates a string containing an encrypted forms-authentication ticket suitable for use in an HTTP cookie.
Determines whether the specified object is equal to the current object.(Inherited from Object.)
Creates an authentication cookie for a given user name. This does not set the cookie as part of the outgoing response, so that an application can have more control over how the cookie is issued.
|GetAuthCookie(String, Boolean, String)|
Creates an authentication cookie for a given user name. This does not set the cookie as part of the outgoing response.
Serves as the default hash function. (Inherited from Object.)
Returns the redirect URL for the original request that caused the redirect to the login page.
Obsolete.Produces a hash password suitable for storing in a configuration file based on the specified password and hash algorithm.
Initializes theobject based on the configuration settings for the application.
Redirects an authenticated user back to the originally requested URL or the default URL.
|RedirectFromLoginPage(String, Boolean, String)|
Redirects an authenticated user back to the originally requested URL or the default URL using the specified cookie path for the forms-authentication cookie.
Redirects the browser to the login URL.
Redirects the browser to the login URL with the specified query string.
Conditionally updates the issue date and time and expiration date and time for a FormsAuthenticationTicket.
Creates an authentication ticket for the supplied user name and adds it to the cookies collection of the response, or to the URL if you are using cookieless authentication.
|SetAuthCookie(String, Boolean, String)|
Creates an authentication ticket for the supplied user name and adds it to the cookies collection of the response, using the supplied cookie path, or using the URL if you are using cookieless authentication.
Removes the forms-authentication ticket from the browser.
Returns a string that represents the current object.(Inherited from Object.)
Forms authentication enables user and password validation for Web applications that do not require Windows authentication. With forms authentication, user information is stored in an external data source, such as a Membership database, or in the configuration file for an application. Once a user is authenticated, forms authentication maintains an authentication ticket in a cookie or in the URL so that an authenticated user does not need to supply credentials with each request.
Forms authentication is enabled by setting the mode attribute of the configuration element to Forms. You can require that all requests to an application contain a valid user authentication ticket by using the configuration element to deny the request of any unknown user, as shown in the following example.
<system.web> <authentication mode="Forms"> <forms loginUrl="login.aspx" /> </authentication> <authorization> <deny users="?" /> </authorization> </system.web>
In the previous example, any request for an ASP.NET page that is part of the application requires a valid user name that is supplied by forms authentication. If no user name exists, then the request is redirected to the configured LoginUrl.
The RedirectToLoginPage method redirects a browser to the configured LoginUrl for users to log into an application. The RedirectFromLoginPage method redirects an authenticated user back to the original protected URL that was requested or to the DefaultUrl. There are also methods that enable you to manage forms-authentication tickets, if needed.class provides access to methods and properties that you can use in an application that authenticates users. The
The following code example shows the Web.config file for an ASP.NET application that uses the ASP.NET membership provider for forms authentication and requires all users to be authenticated.
<configuration> <connectionStrings> <add name="SqlServices" connectionString="Data Source=MySqlServer;Integrated Security=SSPI;Initial Catalog=aspnetdb;" /> </connectionStrings> <system.web> <membership defaultProvider="SqlProvider" userIsOnlineTimeWindow="20"> <providers> <add name="SqlProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="SqlServices" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="true" passwordFormat="Hashed" applicationName="/" /> </providers> </membership> </system.web> </configuration>
The following code example shows the login page for an ASP.NET application that uses forms authentication and ASP.NET membership.
This example contains a text box that accepts user input, which is a potential security threat. By default, ASP.NET Web pages validate that user input does not include script or HTML elements. For more information, see Script Exploits Overview.
Available since 1.1
Any public static (Shared in Visual Basic) members of this type are thread safe. Any instance members are not guaranteed to be thread safe.